Executive Summary

CVE-2026-37221 affects FlexRIC version 2.0.0 and causes the near-RT RIC component to crash when it receives a forged RIC_SUBSCRIPTION_RESPONSE containing an unknown ric_id that does not correspond to any pending event.

The vulnerability arises because the response handler attempts to stop a pending event using the ric_id without verifying if such an event exists. This leads to an assertion failure in debug builds (SIGABRT) or a null pointer dereference in release builds (SIGSEGV), causing the application to crash.

A remote unauthenticated attacker can exploit this by sending a malformed RIC_SUBSCRIPTION_RESPONSE over SCTP to port 36421, triggering the crash.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the near-RT RIC component of FlexRIC to crash unexpectedly, leading to denial of service conditions.

An attacker who exploits this flaw can disrupt the normal operation of the system by sending forged subscription responses, potentially affecting availability and stability.

Since the attacker can be remote and unauthenticated, the risk of exploitation is higher if the SCTP port 36421 is exposed or accessible by untrusted entities.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unexpected crashes of the FlexRIC v2.0.0 near-RT RIC process, especially crashes caused by SIGABRT or SIGSEGV signals when receiving RIC_SUBSCRIPTION_RESPONSE messages.

To detect exploitation attempts on your network, you can capture and analyze SCTP traffic on port 36421 for malformed or forged RIC_SUBSCRIPTION_RESPONSE messages containing unknown ric_id values.

Suggested commands include using packet capture tools like tcpdump or tshark to filter SCTP traffic on port 36421:

• tcpdump -i <interface> port 36421 and sctp
• tshark -i <interface> -f "port 36421 and sctp" -V

Additionally, monitoring system logs for process crashes or core dumps related to the near-RT RIC service can help identify if the vulnerability has been triggered.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting SCTP access to port 36421 on the near-RT RIC to trusted E2 nodes only, effectively limiting the attack surface.

Since no upstream fix was available at the time of disclosure, network-level controls such as firewall rules or SCTP filtering should be applied to block unauthorized or untrusted sources from sending RIC_SUBSCRIPTION_RESPONSE messages.

Monitoring and alerting on unexpected crashes of the near-RT RIC process can also help in early detection and response.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details on how CVE-2026-37221 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0